02 April 2015
CO15078 | The Germanwings Tragedy: Time for Three-Person Rule?
Synopsis
The revelation that Germanwings Flight 4U9525 was brought down deliberately by its co-pilot raises important questions concerning existing aviation security measures in aircraft. The time has come for a three-person rule as a way forward to prevent a recurrence of this tragedy.
Commentary
THE GERMANWINGS Flight 4U9525 incident is the latest in air crashes caused by deliberate pilot action. In November 2013, 33 people were killed when an aircraft flying between Mozambique and Angola was brought down by the pilot. In October 1999, 217 people were killed when an Egypt Air plane crashed allegedly under similar circumstances after leaving New York.
Analyses of Flight 4U9525’s black box reveal that the co-pilot, Andreas Lubitz, locked the pilot out of the flight deck, and thereafter, put the aircraft in descent. Attempts by the pilot to regain access to the cockpit failed owing to Lubitz manually overriding the locking mechanism. This incident raises questions about existing in-flight security measures such as flight deck security mechanisms and access procedures, and pilot health. Proposed solutions have included introducing a mandatory two-person rule on all airlines as well as remotely-controlling a flight from the ground. In light of the limitations of these solutions, perhaps the time has come to introduce a three-person rule.
In-flight security measures backfiring?
The difficulty of re-accessing 4U9525’s flight deck can be attributed to enhanced in-flight security measures many airlines adopted since the September 11 attacks. Cockpit doors are heavily secured with bolts and designed to withstand small arms fire thereby making the flight deck virtually impregnable from the passenger cabin.
Furthermore, if the flight deck is indeed attacked, the pilot or co-pilot can manually override the locking mechanism to disallow access. This measure is both intended to prevent a hijack as well as enable the piloting crew to execute emergency procedures such as mayday calls.
When the manual override is in force, the cabin crew cannot access the flight deck through their emergency access codes as the manual override can ensure the door is locked for five to twenty minutes. Unfortunately, enhanced security measures seem to have back-fired in this instance.
With regard to psychological health, a range of possible stress factors may have caused tremendous psychological strain on the co-pilot. Lubitz was placed on leave for depression in 2009 and was judged to be unfit to fly by the Lufthansa flight school in Arizona. Moreover, investigators have found a doctor’s note in Lubitz’s home dated for the day of the flight – a note that would have prevented him from flying that day.
Despite the importance of pilots’ mental health, they are only required to undergo medical tests every six months to a year to determine their physical competence to operate aircraft and not in-depth psychological tests. Many experts have in fact argued against regular psychological testing as they are far from fool proof as mental illness can be hidden from employers. If this argument is valid then regular psychological testing would not guarantee a recurrence of the 4U9525 incident.
Nevertheless, two proposals have emerged in the wake of the tragedy: mandatory two-person rule for all airlines and remotely controlling aircraft.
Two-person rule and remote control
The two-person rule requires two people to remain in the cockpit at all times. If one of the pilots has to leave the flight deck, a “qualified crew member” must take his/her place on the flight deck. While this requirement is mandatory for US carriers, it is not the case for airlines from Europe, Australia and Asia. Following the 4U9525 crash, many airlines have moved to introduce the two-person rule while some are still deliberating.
Assuming a crisis occurs, the “qualified crew member” who replaces the absent pilot/co-pilot in the flight deck must be adequately trained to handle a wide range of issues including the mental health of the pilot/co-pilot, technical knowledge of aircraft operations, personal security, and intermediate flight knowledge (to know when an aircraft is off-course or is in danger of crashing). However, in most cases, the individual does not possess the required skill set to handle the crisis.
Besides the two person rule, there have also been calls for aircraft to be remotely controlled from the ground in the event of a similar situation. However, this measure is likely to be expensive and may cause even more threats to overall aviation security. Currently, the aircraft operates in a closed system and is heavily reliant on pilots and on-board avionics to fly. By allowing an aircraft to be remotely controlled, the risks become higher as the system becomes vulnerable to cyberattacks.
Way forward: Three-person rule?
Perhaps a way forward is to strengthen the two person rule, by including an unknown “third person” on board the flight, and making in-flight information available to the other passengers. This unknown “third person” could be an employee of the airline or a government agent sitting in the cabin, who has the power to override the cockpit security measures, should the flight deck be locked.
Unlike the United States Air Marshal Service, these individuals are not law enforcement officers, and are not required to carry firearms. These individuals should be pilot-trained, and only be activated in times of distress. These “third persons” can also act as an alternative conduit to air control communication should a plane be placed in a distress situation.
As a matter of transparency, flight information should also be provided in real time to passengers, regardless of aircraft type or flight. Several airlines already provide data – flight path, altitude, time to arrival – to passengers. This should be made mandatory, so that the abovementioned “third person” can react and communicate any unexplained changes in flight patterns, while at the same time remaining anonymous. Although doing this has the capacity to cause panic to the passengers, the benefit of having a professional “third person” on board allows swift and decisive action to be taken before panic sets in.
Most rules regarding aircraft security are made to keep people out of the operation of the aircraft; perhaps it is time to look at the technology and the rules concerning in-flight security as the “enemy” could very well lurk within. While we cannot exclude other factors leading to air crashes, deliberate pilot action is preventable and the security risks can be minimised.
Pilot suicide is not new, and there have been incidences where the pilots have initiated a dive on purpose. Thus, the basic question of quis custodiet ipsos custodes – who will guard the guardians – needs to be revisited and current protocols reviewed to incorporate threats from both within and outside the cockpit.
About the Author
Eugene E G Tan is an Associate Research Fellow at the Centre of Excellence for National Security (CENS), a constituent unit of the S. Rajaratnam School of International Studies (RSIS), Nanyang Technological University in Singapore.
Synopsis
The revelation that Germanwings Flight 4U9525 was brought down deliberately by its co-pilot raises important questions concerning existing aviation security measures in aircraft. The time has come for a three-person rule as a way forward to prevent a recurrence of this tragedy.
Commentary
THE GERMANWINGS Flight 4U9525 incident is the latest in air crashes caused by deliberate pilot action. In November 2013, 33 people were killed when an aircraft flying between Mozambique and Angola was brought down by the pilot. In October 1999, 217 people were killed when an Egypt Air plane crashed allegedly under similar circumstances after leaving New York.
Analyses of Flight 4U9525’s black box reveal that the co-pilot, Andreas Lubitz, locked the pilot out of the flight deck, and thereafter, put the aircraft in descent. Attempts by the pilot to regain access to the cockpit failed owing to Lubitz manually overriding the locking mechanism. This incident raises questions about existing in-flight security measures such as flight deck security mechanisms and access procedures, and pilot health. Proposed solutions have included introducing a mandatory two-person rule on all airlines as well as remotely-controlling a flight from the ground. In light of the limitations of these solutions, perhaps the time has come to introduce a three-person rule.
In-flight security measures backfiring?
The difficulty of re-accessing 4U9525’s flight deck can be attributed to enhanced in-flight security measures many airlines adopted since the September 11 attacks. Cockpit doors are heavily secured with bolts and designed to withstand small arms fire thereby making the flight deck virtually impregnable from the passenger cabin.
Furthermore, if the flight deck is indeed attacked, the pilot or co-pilot can manually override the locking mechanism to disallow access. This measure is both intended to prevent a hijack as well as enable the piloting crew to execute emergency procedures such as mayday calls.
When the manual override is in force, the cabin crew cannot access the flight deck through their emergency access codes as the manual override can ensure the door is locked for five to twenty minutes. Unfortunately, enhanced security measures seem to have back-fired in this instance.
With regard to psychological health, a range of possible stress factors may have caused tremendous psychological strain on the co-pilot. Lubitz was placed on leave for depression in 2009 and was judged to be unfit to fly by the Lufthansa flight school in Arizona. Moreover, investigators have found a doctor’s note in Lubitz’s home dated for the day of the flight – a note that would have prevented him from flying that day.
Despite the importance of pilots’ mental health, they are only required to undergo medical tests every six months to a year to determine their physical competence to operate aircraft and not in-depth psychological tests. Many experts have in fact argued against regular psychological testing as they are far from fool proof as mental illness can be hidden from employers. If this argument is valid then regular psychological testing would not guarantee a recurrence of the 4U9525 incident.
Nevertheless, two proposals have emerged in the wake of the tragedy: mandatory two-person rule for all airlines and remotely controlling aircraft.
Two-person rule and remote control
The two-person rule requires two people to remain in the cockpit at all times. If one of the pilots has to leave the flight deck, a “qualified crew member” must take his/her place on the flight deck. While this requirement is mandatory for US carriers, it is not the case for airlines from Europe, Australia and Asia. Following the 4U9525 crash, many airlines have moved to introduce the two-person rule while some are still deliberating.
Assuming a crisis occurs, the “qualified crew member” who replaces the absent pilot/co-pilot in the flight deck must be adequately trained to handle a wide range of issues including the mental health of the pilot/co-pilot, technical knowledge of aircraft operations, personal security, and intermediate flight knowledge (to know when an aircraft is off-course or is in danger of crashing). However, in most cases, the individual does not possess the required skill set to handle the crisis.
Besides the two person rule, there have also been calls for aircraft to be remotely controlled from the ground in the event of a similar situation. However, this measure is likely to be expensive and may cause even more threats to overall aviation security. Currently, the aircraft operates in a closed system and is heavily reliant on pilots and on-board avionics to fly. By allowing an aircraft to be remotely controlled, the risks become higher as the system becomes vulnerable to cyberattacks.
Way forward: Three-person rule?
Perhaps a way forward is to strengthen the two person rule, by including an unknown “third person” on board the flight, and making in-flight information available to the other passengers. This unknown “third person” could be an employee of the airline or a government agent sitting in the cabin, who has the power to override the cockpit security measures, should the flight deck be locked.
Unlike the United States Air Marshal Service, these individuals are not law enforcement officers, and are not required to carry firearms. These individuals should be pilot-trained, and only be activated in times of distress. These “third persons” can also act as an alternative conduit to air control communication should a plane be placed in a distress situation.
As a matter of transparency, flight information should also be provided in real time to passengers, regardless of aircraft type or flight. Several airlines already provide data – flight path, altitude, time to arrival – to passengers. This should be made mandatory, so that the abovementioned “third person” can react and communicate any unexplained changes in flight patterns, while at the same time remaining anonymous. Although doing this has the capacity to cause panic to the passengers, the benefit of having a professional “third person” on board allows swift and decisive action to be taken before panic sets in.
Most rules regarding aircraft security are made to keep people out of the operation of the aircraft; perhaps it is time to look at the technology and the rules concerning in-flight security as the “enemy” could very well lurk within. While we cannot exclude other factors leading to air crashes, deliberate pilot action is preventable and the security risks can be minimised.
Pilot suicide is not new, and there have been incidences where the pilots have initiated a dive on purpose. Thus, the basic question of quis custodiet ipsos custodes – who will guard the guardians – needs to be revisited and current protocols reviewed to incorporate threats from both within and outside the cockpit.
About the Author
Eugene E G Tan is an Associate Research Fellow at the Centre of Excellence for National Security (CENS), a constituent unit of the S. Rajaratnam School of International Studies (RSIS), Nanyang Technological University in Singapore.
